PT-2026-35910 · WordPress · Wp Meteor Website Speed Optimization Addon

Published 2026-04-29 · Updated 2026-04-29 · CVE-2026-2902

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions WP Meteor Website Speed Optimization Addon versions prior to 3.4.17

Description Insufficient input sanitization and output escaping in the frontend rewrite() function's WPMETEOR[N]WPMETEOR placeholder content allow unauthenticated attackers to inject arbitrary web scripts. These scripts execute whenever a user accesses an affected page. This is a Stored Cross-Site Scripting issue, which occurs when an application stores malicious input on the server and later embeds it into a web page served to other users.

Recommendations Update to a version later than 3.4.16. As a temporary workaround, restrict access to the frontend rewrite() function to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-2902

Affected Products

Wp Meteor Website Speed Optimization Addon

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2026-2902 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/dc92b20a-fb9b-477c-8fe4-68897c1fd07e?source=cve · Note
• https://plugins.trac.wordpress.org/browser/wp-meteor/trunk/blocker/FirstInteraction/UltimateReorder.php#L186 · Note
• https://plugins.trac.wordpress.org/browser/wp-meteor/trunk/frontend/Rewrite.php#L43 · Note
• https://plugins.trac.wordpress.org/browser/wp-meteor/trunk/blocker/FirstInteraction/UltimateReorder.php#L68 · Note
• https://plugins.trac.wordpress.org/changeset/3466538 · Note
• https://twitter.com/CVEnew/status/2049594368550375901 · Twitter Post